Adding support for AVIO ANCP3005Q (AR9344)

For Developers
1

I purchased this device on eBay as ‘open box’. It turned out to be yellowed and dead without accessories in a box with a different serial number. I got a full refund without return.

This appears to be an old design that AVIO continues to produce. The date code on the SOC is 2012, but some of the other ICs appear to be 2020s. It’s an incredibly simple single-sided PCB with a nice aluminum antenna mounted to the back. It’s POE and supposedly has POE back out the second RJ45. I’d like to mount the guts behind a PVC access panel in my front porch ceiling.

SOC: Atheros AR9344
FLASH: Macronix MX25L12833F (16MB SPI)
RAM: Winbond W9751G6NB (64MB DDR2)

ANCP3005Q
ANCP3005Q1920×688 150 KB

ANCP3005Q_back
ANCP3005Q_back1920×687 137 KB

My situation is complicated by the fact that my device appears dead. I’m hopeful that it’s just corrupt FLASH. There’s 3.3V on the serial header. Several LEDs light up. Other LEDs are dim suggesting uninitialized GPIO. POE works, but there’s no Ethernet link. The reset button does nothing whether short or long press. There’s no obvious Wi-Fi activity.

I see that several similar devices have already been added to OpenWrt. My plan is to replace the SPI FLASH with a header and daughter board so that I can easily manipulate. I can then connect a logic probe and see if the SOC is even talking to the FLASH. The OEM firmware is available, but I haven’t examined the format. The only unknowns appear to be the OEM locations of MAC and calibration data, and the GPIO pins. Is there some diagnostic image I could try in the FLASH?

@pepe2k are you still out there?

Update Dec-31-2025: My eBay saved search snagged another of these cheap. It was still shrink-wrapped. The built-in firmware is not bad, but I now realize some hardware shortcomings. The Ethernet ports are only 100Mbps. I could accept that for an outside AP. However, it only operates on 5GHz. That might help us in our front yard, but the Ring doorbell is only 2.4GHz. Even if the SoC supports 2.4GHz, the antennas and other RF circuitry probably won’t. I’m still going to dump the FLASH and see if it can be used to revive the original bricked unit.

2

If it is not functional as is then it is hard to tell if it is electrical defect or not working.

Can you arrach ttl adapter to 3 non-3.3v pins and try to see if OEM firmware shows some boot messages?

3

device marketing page https://avyconaivo.com/shop/item.php?it_id=ANCP3005Q&ca_id=f0

4

MAC addresses are in general not in upgrades, you somehow have to find them in dumped flash content.

No, you dont flash yet, based on crumbples recoverable from oem console and firmware you can try tftp-booting OpenWrt meant for similar device.

5

No output on the serial port. It’s hard to believe the hardware could be defective. The SOC and RAM are BGA, so something could have come loose. However, the PCB is supported by a rigid aluminum plate, so flexing seems unlikely. Since the PCB is single-sided, I could try reflow as a last resort.

There’s no link from the Ethernet ports, so TFTP isn’t going to work. :frowning: Current plan is to read the FLASH and probably set it aside. I’d start over with a new SPI FLASH with easy detachment.

It’s old hardware, but I like the simple design.

6

You are quite blind without system console as there is no telling what is going on. You really need a functional device, like emitting wifi and ethernet.

Do you have a link to OEM upgrade file?

7

Sorry, I’ve got too many concurrent projects. I misspoke. I don’t actually have the OEM firmware for this device. I’ll have to see what I can get from support. At least their support responds in a timely matter.

Cheap POE access point where I can easily transplant the internals?
8

While anything goes for your personal development, if you want to see it supported by OpenWrt, you'll need to recover the OEM flash - at least to the extent of determining the OEM partitioning, MAC addresses and wifi calibration data (ART, especially the later cannot be recovered any other way than fetching it from the OEM flash).

So the very first course of action will be to dump the spi-nor flash (e.g. using a ch341 spi-nor flasher), backing it up really-really-well and taking a peek into that. You are the arbiter of how much effort you then want to put into a rather dated and defective device (of which you have no idea what might be broken).